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(54) Contents data conversion apparatus and method, and record mediunn storing contents data 
conversion program 



(57) A contents data conversion apparatus for en- 
crypting or decrypting streams of contents data which 
are each divided into a plurality of frames, each frame 
including a piece of header information and a contents 
portion, the piece of header Infomnation Including at- 
tribute information of the frame, all contents portions in 
each stream of contents data forming a content. The 
contents data conversion apparatus comprises: an ac- 
quisition unit which acquires one or more streams of 



contents data; an extraction unit which extracts frames 
one by one from the contents data; a separation unit 
which separates each frame into the piece of header in- 
formation and the contents portion; a conversion unit 
which either encrypts or decrypts each contents portion 
to generate a converted contents portion; and a combi- 
nation unit which combines each piece of header infor- 
mation with each converted contents portion, and out- 
puts a result of the combination. 
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Description 

BACKGROUND OF THE INVENTION 

(1) Field of the Invention 

[0001 1 The present invention relates to a contents da- 
ta conversion apparatus. More particularty, the present 
invention relates to a technique for decrypting encrypted 
contents data including a plurality of frames at high 
speed, and also relates to a technique for generating 
the encrypted contents data which has the same secu- 
rity level as conventional ones. 

(2) Description of Related Art 

[0002] Services for distributing music or the like rep- 
resented by digital data (hereinafter referred to as con- 
tents data) via a network are becoming practical. 
[0003] Conventionaify, contents data reception/repro- 
duction apparatuses for use in such distribution services 
have been achieved as a function of a personal compu- 
ter. The conventional contents data reception/reproduc- 
tion apparatuses receive and store the distributed con- 
tents data into a storage apparatus therein, read and 
convert the contents data into an analog audio signal, 
and output the analog audio signal. 
[0004] FIG. 10 shows the construction of conventional 
contents data 700 which represents music or the like, 
conforms to the MP3 standard, and is distributed by the 
distribution service. As shown in FIG. 10, the contents 
data 700 includes frames 701 to 704, where "frame*' is 
a unit of contents data. The frames 701 to 704 include: 
(1) header fields 711 to 714 which hold attribute infor- 
mation of the frame; and (2) data fields 721 to 724 which 
hold audio data representing music or the like, respec- 
tively. 

[0005] Each header field holds attribute information 
which indicates, for example, whether the data held by 
the data field Is for stereo or monaural. Each data field 
holds compressed digital audio data which represents 
music to be played for a certain time period. 
[0006] The header field and the data field have a fixed 
length, respectively. Naturally, the frames composed of 
the header fields and the data fields have a fixed length. 
More specifically. In the case of contents data conform- 
ing to the MP3 standard and having 48 KHz of sampling 
frequency and 128 Kbps of bit rate, the header field is 
4 bytes and the data field is 384 bytes in length. 
[0007] The distribution services desire a new data 
compression/decompression method which allows a 
certain amount of data to represent higher quality music 
so that high-quality contents data can be distributed at 
conventional communication costs. To fulfill the desire, 
data compression/decompression methods for improv- 
ing the data compression efficiency have been devel- 
oped. One of such methods is AAC (Advanced Audio 
Coding). 



[0008] The AAC method is a technique for improving 
the data compression efficiency by compressing each 
piece of digital audio data corresponding to a certain 
play time so that each piece of the compressed digital 
5 audio data has a different amount of data in proportion- 
ate to the original amount of audio data. The com- 
pressed data is recorded as it is. The frames in the AAC 
method have variable lengths. As a result, to recognize 
the range of each frame, each header field includes: (l) 
a synchronization code indicating the start of the frame; 
and (2) a numeral indicating the length of the frame. 
[0009] It is expected that by using the contents data 
conforming to the AAC method, the quality of the con- 
tents data that can be distributed at a certain communi- 
cation cost will be improved and the distribution service 
will be used more frequently. 
[0010] The conventional contents data reception/re- 
production apparatuses, however, have a problem. That 
is, since they record the received contents data without 
encrypting it, namely in a format that allows everyone to 
access the contents data, the distributed contents can 
be copied easily, which inhibits the distribution services 
from developing healthily. 

[001 1 ] For the above reasons, it has strongly been de- 
sired to manage the accesses to the contents data to 
prevent improper accesses by encrypting the contents 
data so that only users having a proper decryption key 
can handle (i.e., reproduce, copy, etc.) the contents da- 
ta. Such a management of accesses to contents data 
has not been achieved yet since it takes a lot of time to 
decrypt the encrypted contents data from some mid- 
point in the data. 

[0012] The above problem is generated for the follow- 
ing reasons. 

[0013] Generally, for encryption or decryption, the 
contents data is divided into units having a certain size 
(referred to as encryption processing unit) and the con- 
tents data is encrypted or decrypted for each encryption 
processing unit. In general, the larger the encryption 
processing unit is, the higher the security level is due to 
the difficulty in identifying a key for decryption. Also, the 
smaller the encryption processing unit is, the smallerthe 
processing time is. The size of the encryption process- 
ing unit is determined (to 64 bits, for example) by con- 
sidering the merits and demerits of both conditions. 
[0014] What is called chain key method has been 
used in which the first encryption processing unit of each 
frame is encrypted using a certain key (referred to as 
initial key), and each succeeding encryption processing 
unit is encrypted using a key which Is detenmined from 
the content of the previous encryption processing units 
(referred to as chain key). Since it is very difficult for us- 
ers with improper intentions to correctly identify the ini- 
tial key and all of the chain keys, this method enhances 
the security level of the encrypted contents data. 
[001 5] In decryption, it is also required to use the Initial 
key and the chain keys properly. The process for detect- 
ing the first encryption processing unit of each frame Is 
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therefore very important. 

[0016] However, the synchronization code is not al- 
ways encrypted to the same value. It is therefore impos- 
sible to detect an encrypted synchronization code by de- 
tecting a certain value in encrypted contents data. 
[0017] As a result, to decrypt encrypted contents data 
(typically, contents data encrypted with the AAC meth- 
od) with variable-length frames from a desired midpoint, 
the apparatus must repeat, up to the desired frame, the 
process of decrypting the header field of a frame and 
determining the starting position of the next, frame 
based on the frame length information included in the 
decrypted header field. This requires a lot of time due 
to a large amount of calculation in the above decryption 
process. 

[0018] The above problem is experienced with the en- 
crypted contents data including the fixed-length frames 
(typically contents data conforming to the MP3 stand- 
ard) when one stream of data includes a plurality of 
tunes having different frame lengths, that is, tunes rep- 
resented by different sampling frequencies or bit rates. 

SUMMARY OF THE INVENTION 

[001 9] It is therefore an object of the present invention 
to provide a contents data conversion apparatus which 
decrypts encrypted contents data including a plurality of 
frames at high speed, and also generates the encrypted 
contents data which has the same security level as con- 
ventional ones. 

(1) The above object is fulfilled by a contents data 
conversion apparatus for either encrypting or de- 
crypting streams of contents data which are each 
divided into a plurality of frames, each frame includ- 
ing a piece of header information and a contents 
portion, the piece of header information including 
attribute information of the frame, all contents por- 
tions in each stream of contents data forming a con- 
tent, the contents data conversion apparatus com- 
prising: an acquisition unit operable to acquire one 
or more streams of contents data; an extraction unit 
operable to extract frames one by one from the one 
or more streams of contents data; a separation unit 
operable to separate each of the extracted frames 
into the piece of header information and the con- 
tents portion; a conversion unit operable to either 
encrypt or decrypt each contents portion to gener- 
ate a converted contents portion; and acombination 
unit operable to combine each piece of header in- 
formation with each converted contents portion, 
and output a result of the combination. 

With the above construction, the contents data 
conversion apparatus neither encrypts nordecrypts 
the header field in each frame of the contents data. 
As a result, when the header information includes 
some information indicating the start of a frame, 
each frame can be found without decrypting the 



header fields. This enables the contents data to be 
decrypted at high speed. Each contents portion is 
decrypted. As a result, it is possible to generate the 
encrypted contents data which has the same secu- 
5 rity level as conventional ones and can be decrypt- 
ed at high speed. 

(2) In the above contents data conversion appara- 
tus, the piece of header infonmation of each frame 
may include, at a certain position in the piece of 

10 header infonmation, a synchronization code that is 
a predetermined pattern of bits, and the extraction 
unit detects the synchronization code from each 
piece of header information and extracts each 
frame from the one or more streams of contents da- 

15 ta based on the detected synchronization codes. 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (1) above. 

(3) In the above contents data conversion appara- 
20 tus. the piece of header infomiation of each frame 

may include, subsequent to the synchronization 
code, frame length information Indicating a length 
of the frame, and the extraction unit detects the 
frame length information and extracts each frame 

25 by extracting the synchronization code and suc- 
ceeding data of the length indicated by the detected 
frame length information from the one or more 
streams of contents data. 

With the above construction, it Is possible to ob- 

30 tain the same effect as the contents data conversion 
apparatus of (1) above. 

(4) In the above contents data conversion appara- 
tus, the piece of header infomnation of each frame 
may be located at a start of the frame and has a 

35 fixed length, and the separation unit separates the 
piece of header information by separating a starting 
portion having the fixed length from each separated 
frame, and separates a remaining portion of the 
frame as the contents portion. 

40 with the above construction, it is possible to ob- 

tain the same effect as the contents data conversion 
apparatus of (1) above. 

(5) In the above contents data conversion appara- 
tus, the acquisition unit acquires one or more pieces 

45 of range information corresponding to the one or 
more streams of contents data on a one-to-one ba- 
sis, each piece of range information indicating a 
block in the one or more streams of contents data, 
and the extraction unit extracts each frame from 

50 each block by detecting the synchronization code 
included in each block Indicated by each piece of 
range Information. 

With the above construction, when an editing 
apparatus or the like instructs the contents data 

55 conversion apparatus to encrypt or decrypt a cer- 
tain range of the contents data, the contents data 
conversion apparatus can find locations of the 
frames included in the specified range at high speed 
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and encrypt or decrypt the range at high speed. 

(6) In the above contents data conversion appara- 
tus, the conversion unit may divide each separated 
contents portion into processing units each having 

a predetemriined length, In order from a start, either s 
encrypts or decrypts each processing unit, and 
combines all encrypted or decrypted processing 
units of each separated contents portion with an 
end part of the separated contents portion to gen- 
erate each converted contents portion, the end part io 
being smaller than one processing unit. 

With the above construction, when the contents 
data conversion apparatus encrypts or decrypts in 
units of processing units, the odd piece of contents 
data that is at the end of each contents portion and 
is smaller than one processing unit is neither en- 
crypted nor decrypted. There is, therefore, no need 
to add temporary data to the end of each contents 
portion to form a processing unit. This prevents the 
amount of contents data from increasing. In this 20 
case, the odd piece of contents data at the end of 
each data field is neither encrypted nor decrypted. 
However, the ratio of it to the entire amount of the 
data field is very small. Therefore, even if someone 
reproduces the data field and can hear a fragment 25 
of a tune at the odd piece of contents data, it does 
not make sense for the listener. From this point of 
view, the security level of the encrypted contents 
data is not degraded. 

(7) In the above contents data conversion appara- 30 
tus, the combination unit may further output the one 

or more streams of contents data acquired by the 
acquisition unit excluding the frames extracted by 
the extraction unit. 

With the above construction, it is possible, for 35 
example, to specify a range of contents data for 
which a fee is charged, the contents data in the 
range being encrypted and decrypted, and to allow 
the remaining contents data to be provided to the 
user for a test-listen without charge. 

(8) In the above contents data conversion appara- 
tus of (6), the combination unit may further output 
null data as a replacement for parts of the one or 
more streams of contents data acquired by the ac- 
quisition unit other than the frames extracted by the 45 
extraction unit. 

With the above construction, the contents data 
conversion apparatus outputs null data as a re- 
placement for parts of contents data other than the 
specified range. This restricts the amplitude of the 50 
output signal, decreasing the electricity consump- 
tion by the apparatus. 

(9) In the above contents data conversion appara- 
tus of (1), the extraction unit may include one or 
more sub-extraction units which operate in parallel, 55 
the one or more sub-extraction units conresponding 

to the one or more streams of contents data on . a 
one-to-one basis, and each sub-extraction unit ex- 



tracting frames one by one from a corresponding 
stream of contents data, the separation unit in- 
cludes one or more sub-separation units which cor- 
respond to the one or more sub-extraction units on 
a one-to-one basis and operate in parallel, each 
sub-separation unit separating each frame extract- 
ed by a corresponding sub-extraction unit into the 
piece of header infonmation and the contents por- 
tion and storing the contents portion, the conversion 
unit converts each contents portion separated by 
each sub-separation unit into each converted con- 
tents portion, and the combination unit includes one 
or more sub-combination units which correspond to 
the one or more sub-separation units on a one-to- 
one basis and operate in parallel, each sub-combi- 
nation unit combining each piece of header infor- 
mation separated by a corresponding sub-separa- 
tion unit with each converted contents portion con- 
verted from each contents portion separated by the 
con-esponding sub-separation unit, and outputting 
a result of the combination. 

With the above construction, the contents data 
conversion apparatus processes a plurality of 
streams of contents data simultaneously, in the 
eyes of the user. If, for example, a stream of con- 
tents data is not distributed at the real-time rate due 
to the slow communication speed in the network, 
users can receive this stream of contents data, and 
at the same time reproduce another stream of en- 
crypted contents data having already been ob- 
tained. This improves the utility of the present ap- 
paratus. 

(1 0) In the above contents data conversion appara- 
tus, the acquisition step may acquire multiplexed 
contents data in which a plurality of streams of con- 
tents data have been multiplexed, separates the 
multiplexed contents data into the plurality of 
streams of contents data, and the one or more sub- 
extraction units conrespond to the plurality of 
streams of contents data on a one-to-one basis, and 
each sub-extraction unit extracts frames one by one 
from a corresponding stream of contents data sep- 
arated by the acquisition unit 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (9) above. 

(1 1 ) In the above contents data conversion appara- 
tus, the piece of header infonnation of each frame 
may include, at a certain position in the piece of 
header information, a synchronization code that is 
a predetermined pattern of bits, and each sub-ex- 
traction unit detects the synchronization code from 
each piece of header information in the correspond- 
ing stream of contents data separated by the acqui- 
sition unit, and extracts each frame from the corre- 
sponding stream of contents data based on the de- 
tected synchronization codes. 

With the above construction, it is possible to ob- 
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tain the same effect as the contents data conversion 
apparatus of (2) above, for each stream of contents 
data. 

(12) In the above contents data conversion appara- 
tus, the piece of header Information of each frame 5 
may include, subsequent to the synchronization 
code, frame length information indicating a length 

of the frame, and each sub-extraction unit detects 
the frame length information and extracts each 
frame by extracting the synchronization code and io 
succeeding data of the length indicated by the de- 
tected frame length information from the corre- 
sponding stream of contents data. 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (3) above, for each stream of contents 
data. 

(13) In the above contents data conversion appara- 
tus, the piece of header information of each frame 
may be located at a start of each frame and has a 20 
fixed length, and each sub-separation unit sepa- 
rates the piece of header information by separating 

a starting portion having the fixed length from each 
frame separated by the corresponding sub-extrac- 
tion unit, and separates a remaining portion of the 25 
frame as the contents portion. 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (4) above, for each stream of contents 
data. 30 

(14) In the above contents data conversion appara- 
tus, the acquisition step may acquire one or more 
pieces of range Information con^esponding to the 
one or more streams of contents data on a one-to- 
one basis, each piece of range Information indicat- 35 
ing a block In the one or more streams of contents 
data, and each sub-extraction unit extracts each 
frame from each block by detecting the synchroni- 
zation code included in each block Indicated by 
each piece of range information. ^0 

With the above construction, It is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (5) above, for each stream of contents 
data. 

(1 5) In the above contents data conversion appara- 45 
tus, the conversion unit may divide each separated 
contents portion into processing units each havirig 

a predetenmined length, in order from a start, either 
encrypts or decrypts each processing unit, and 
combines all encrypted or decrypted processing so 
units of each separated contents portion with an 
end part of the separated contents portion to gen- 
erate each converted contents portion, the end part 
being smaller than one processing unit. 

With the above construction, it is possible to ob- ss 
tain the same effect as the contents data conversion 
apparatus of (6) above, for each stream of contents 
data. 



(1 6) In the above contents data conversion appara- 
tus, each sub-combination unit may further output 
the corresponding stream of contents data separat- 
ed by the acquisition unit excluding the frames ex- 
tracted by the corresponding sub-extraction unit. 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (7) above, for each stream of contents 
data. 

(1 7) In the above contents data conversion appara- 
tus of (15), each sub-combination unit may further 
output null data as a replacement for parts of the 
con-esponding stream of contents data separated 
by the acquisition unit other than the frames extract- 
ed by the corresponding sub-extraction unit. 

With the above construction, it is possible to ob- 
tain the same effect as the contents data conversion 
apparatus of (8) above, for each stream of contents 
data. 

(1 8) The above object is also fulfilled by a contents 
data conversion method for use in a contents data 
conversion apparatus for either encrypting or de- 
crypting streams of contents data, the contents data 
conversion method comprising: an acquisition step 
for acquiring one or more streams of contents data; 
an extraction step for extracting frames one by one 
from the one or more streams of contents data; a 
separation step for separating each of the extracted 
frames Into the piece of header information and the 
contents portion; a conversion step for either en- 
crypting or decrypting each contents portion to gen- 
erate a converted contents portion; and a combina- 
tion step for combining each piece of header infor- 
mation with each converted contents portion, and 
outputting a result of the combination. 

With the above construction, it is possible to 
achieve a contents data conversion method having 
the same effect as the contents data conversion ap- 
paratus of (1) above. 

(1 9) The above object is also fulfilled by a computer- 
readable record medium recording a program for 
use in a contents data conversion apparatus for ei- 
ther encrypting or decrypting streams of contents 
data, the program comprising: an acquisition step 
for acquiring one or more streams of contents data; 
an extraction step for extracting frames one by one 
from the one or more streams of contents data; a 
separation step for separating each of the extracted 
frames into the piece of header information and the 
contents portion; a conversion step for either en- 
crypting or decrypting each contents portion to gen- 
erate a converted contents portion; and a combina- 
tion step for combining each piece of header Infor- 
mation with each converted contents portion, and 
outputting a result of the combination. 

With the above construction, it is possible to 
achieve a record medium storing a program having 
the same effect as the contents data conversion ap- 
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paratus of (1) above. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0020] These and other objects, advantages and fea- 
tures of the invention will become apparent from the fol- 
lowing description thereof taken in conjunction with the 
accompanying drawings which illustrate a specific em- 
bodiment of the invention. In the drawings: 

FIG. 1 shows an appearance of the contents data 
reception/reproduction apparatus including the 
contents data conversion apparatus; 
FIG. 2 shows the construction of the contents data 
110 in the Embodiment 1; 
FIG. 3 shows the construction of the entire contents 
data reception/reproduction apparatus 100 in Em- 
bodiment 1 ; 

FIG. 4 shows the constajctlon of the encryption con- 
trol unit 50 in Embodiment 1; 
FIG. 5 shows a detailed operation of the encryption 
control unit 50 in Embodiment 1; 
FIG. 6 shows the construction of the contents data 
reception/reproduction apparatus 100 In Embodi- 
ment 2; 

FIG. 7 shows a construction of the contents data 
300 in Embodiment 2; 

FIG. 8 shows the construction of the encryption con- 
trol unit 50 in Embodiment 2; 
FIG. 9 shows a detailed operation of the encryption 
control unit 50 in Embodiment 2; and 
FIG. 1 0 shows the construction of the conventional 
contents data 700. 

DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

<Embodiment 1> 

[0021] The following is a description of the contents 
data conversion apparatus in Embodiment 1 explained 
with reference to the drawings. 

Outline 

[0022] The contents data conversion apparatus is 
built into a contents data reception/reproduction appa- 
ratus, as an encryption control apparatus to encrypt and 
decrypt contents data. The contents data reception/re- 
production apparatus is achieved as, for example, an 
additional function to a personal computer^ a portable 
Infonmation equipment, a handheld telephone, or a ded- 
icated equipment. The contents data reception/repro- 
duction apparatus receives contents data distributed 
through a wired or wireless network, encrypts the re- 
ceived contents data using the encryption control appa- 
ratus so that only users having a proper decryption key 
can reproduce and/or copy the data, and stores the en- 



crypted data into a memory card. The contents data re- 
ception/reproduction apparatus also decrypts and cop- 
ies the encrypted contents data in the memory card us- 
ing the encryption control apparatus. 
5 [0023] FIG. 1 shows the appearance of the contents 
data reception/reproduction apparatus including the 
contents data conversion apparatus and achieved as an 
additional function to a handheld telephone. In FIG. l . 
"1" indicates the contents data reception/reproduction 
10 apparatus as a handheld telephone, "2" the encryption 
control apparatus as included in the contents data re- 
ception/reproduction apparatus, "3" a headphone, and 
"4" the memory card. The memory card 4 can be insert- 
ed into and removed from the contents data reception/ 
15 reproduction apparatus 1 . 

[0024] Since the memory card 4 is constructed to be 
able to be inserted into and removed from the contents 
data reception/reproduction apparatus 1 , a user having 
a proper decryption key not only can decrypt and repro- 
ve duce the encrypted contents data stored in the memory 
card 4 using the contents data reception/reproduction 
apparatus 1 , but Insert the memory card 4 into another 
contents data reproduction apparatus to reproduce the 
contents data. 

25 [0025] On the other hand, users not having the proper 
decryption key can neither reproduce nor copy the con- 
tents data stored in the memory card 4. This eliminates 
improper accesses to the contents data. 

30 Contents Data 110 

[0026] FIG. 2 shows the construction of the contents 
data 1 1 0 in the present embodiment. The contents data 

110 conforms to, for example, the AAC method having 
35 been described earlier, and includes frames 1 01 to 1 07, 

where "frame" is a construction unit defined in the AAC 
method. Each frame includes a header field (In FIG. 2, 

111 to 117 denote header fields) and a data field (in FIG. 
2, 121 to 127 denote data fields). Each header field has 

40 fixed length of 56 bits. The data field has variable length 
of a multiple of eight bits (one byte). 
[0027] The data field holds compressed digital audio 
data corresponding to a certain play time. Each data 
field holds a different amount of data. 

45 [0028] The header field is composed of a synchroni- 
zation code 131 , frame attribute information 1 41 , and a 
frame length value 151. 

[0029] The synchronization code 131 is a series of 12 
"1" bits that are located at the start of the header field. 

50 The frame length value 151 is 13 bits in size, ranging 
from the 31 bit to the 43"^ bit of the header field, and 
indicates the number of bytes included in the frame (i. 
e., the number of bits/8). The frame attribute information 
141 is a part of the header field excluding the synchro- 

55 nization code 1 31 and frame length value 151, and holds 
attribute infonmation specifying the attribute of the data 
held by the data field, for example, whether the data is 
for stereo or monaural. 
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[0030] The contents data 110 is transferred among 
components of the contents data reception/reproduc- 
tion apparatus one data management block at a time. 
The data management block is a unit that is not related 
to the logical construction of the contents data itself, but 
is determined in accordance with, for example, the data 
bus or file system-actually adopted in the apparatus. In 
the present embodiment, the data management block 
has a size of 51 2 bytes. In FIG. 2. "1 61" to "1 63" indicate 
data management blocks. 

Contents data reception/reproduction apparatus 

[0031 ] FIG. 3 shows the construction of the entire con- 
tents data reception/reproduction apparatus 100. The 
contents data reception/reproduction apparatus 100 in- 
cludes a communication interface unit 10, a compres- 
sion/decompression unit 20, a D/A conversion unit 30, 
a speaker 35, an A/D conversion unit 40, a microphone 
45, an encryption control unit 50, a memory interface 
unit 60, a memory card 70, a user interface unit 80, and 
a control unit 90. 

[0032] Each component of the contents data recep- 
tion/reproduction apparatus 1 00 is used not only to proc- 
ess the contents data, but to achieve functions of a gen- 
eral handheld telephone. In the following description, 
each component is explained based on the former func- 
tion thereof. 

[0033] The communication interface unit 10 receives 
the contents data distributed via a wireless network and 
outputs the received data to the encryption control unit 
50. It should be noted here that the contents data is en- 
coded before it Is distributed via the network in order to 
prevent entanglement, eavesdropping and the like on 
the network. The communication interface unit 10 de- 
codes the received contents data in terms of the above 
encoding. 

[0034] The encryption control unit 50 encrypts the 
contents data received from the communication inter- 
face unit 1 0, and stores the encrypted contents data into 
the memory card 70 via the memory interface unit 60. 
The encryption control unit 50 reads and decrypts the 
encrypted contents data stored in the memory card 70, 
and outputs the decrypted data to the compression/de- 
compression unit 20. 

[0035] The compression/decompression unit 20 de- 
compresses the contents data output from the encryp- 
tion control unit 50 to digital audio data, and outputs the 
digital audio data to the D/A conversion unit 30. 
[0036] The D/A conversion unit 30 converts the digital 
audio data output from the compression/decompression 
unit 20 into an analog audio signal and allows the speak- 
er 35 to outputs the analog audio signal as the sound. 
[0037] The PJD conversion unit 40 and the micro- 
phone 45 are used mainly for the telephone conversa- 
tion function of the handheld telephone. The A/D con- 
version unit 40 converts the user's voice into digital au- 
dio data and outputs the digital audio data to the com- 



pression/decompression unit 20. The digital audio data 
is compressed by the compression/decompression unit 
20 and then transmitted via the communication interface 
unit 10. 

5 [0038] The user interface unit 80 is constructed of, for 
example, keys and a liquid crystal display, receives us- 
er's instructions to receive or reproduce the contents da- 
ta, and presents information such as the title of the cur- 
rently played tune, the elapsed playing time or the like 

10 to the user. 

[0039] The control unit 90 is constructed of a micro- 
computer and an embedded ROM and controls the en- 
tire contents data reception/reproduction apparatus 1 00 
by allowing the microcomputer to execute a program 

15 stored in the embedded ROM. . 

[0040] The control unit 90, when reproducing a part 
of the encrypted contents data stored in the memory 
card 70, provides the encryption control unit 50 with in- 
formation indicating a range of the part of the contents 

20 data to be reproduced. 

Encryption Control Unit 50 

[0041 ] FIG, 4 shows the construction of the encryption 
25 control unit 50. The encryption control unit 50 is com- 
posed of an acquisition unit 51 , a judgement unit 52, a 
separation unit 53, an encryption calculation unit 54, and 
a combination unit 55. The encryption control unit 50 
generates encrypted contents data by encrypting only 
30 the data field of the contents data, and restores the orig- 
inal contents data by decrypting only the data field of the 
encrypted contents data. 

Acquisition Unit 51 

35 

[0042] The acquisition unit 51 includes an input data 
buffer 511, a block-length counter 513, an effective 
range judgement unit 514, and an effective range reg- 
ister 51 5. 

40 [0043] The acquisition unit 51 acquires the contents 
data from the communication interface unit 10 or the 
memory interface unit 60 one data management block 
of 51 2 bytes at a time, and stores the acquired data into 
the input data buffer 511 one data management block 

45 at a time. 

[0044] The acquisition unit 51. at the same time as 
acquires the contents data one data management block 
at a time, acquires from the control unit 90: (1 ) numerals 
indicating the start byte and the end byte of a range in- 

50 eluding effective data for each acquired data manage- 
ment block; and (2) a flag indicating the last data man- 
agement block that includes the last portion of the effec- 
tive data, and stores the acquired numerals and flag into 
the effective range register 51 5. 

55 [0045] The block-length counter 513 shows the bytes 
#1 to #512 in order for each acquired data management 
block. The input data buffer 51 1 supplies the judgement 
unit 52. separation unit 53, and combination unit 55 with 
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byte data corresponding to the byte serial numbers 
shown by the block-length counter 513 (hereinafter, 
each byte of the contents data supplied from the input 
data buffer 511 is referred to as byte data). 
[0046] The effective range judgement unit 514 out- 
puts an effective signal indicating that the byte data in 
the range indicated by the effective range register 515 
is effective. 

Judgement Unit 52 

[0047] The judgement unit 52 includes a synchroni- 
zation signal detection unit 521 , a frame length extrac- 
tion unit 522, a frame length counter 523, a processing 
necessity judgement unit 524, and an initial unit judge- 
ment unit 525, and judges whether each piece of byte 
data should be encrypted or decrypted. 
[0048] The synchronization signal detection unit 521 
detects the start of a series of 12 "1" bits by monitoring 
the byte data in the range indicated by the effective 
range register 515 when the frame length counter 523 
has value 0. 

[0049] The frame length extraction unit 522 extracts 
a numeral indicating the frame length from a certain rel- 
ative position in the contents data with reference to the 
position detected by the synchronization signal detec- 
tion unit 521 , .and stores the numeral. 
[0050] The frame length counter 523 has value "0" as 
the initial value, and when the synchronization signal de- 
tection unit 521 detects the start of a series of bits "1", 
holds value "1" indicating the byte data at the detected 
start position, then increments the value by "r each 
time byte data is supplied from the acquisition unit 51 . 
In this way, the frame length counter 523 holds a value 
showing a serial byte number in a frame. The frame 
length counter 523 holds value "0" for a piece of byte 
data supplied after the value reaches the frame length 
stored in the frame length extraction unit 522. 
[0051] The processing necessity judgement unit 524 
judges whether encryption or decryption is necessary, 
and judges positively when the following condition is sat- 
isfied: 

8^n^int((f-7)/8)x8+7 

where "n" is a value held by the frame length counter 
523, T a value held by the frame length extraction unit 
522, and ''int(x)" the highest integer under "x". Note that 
the target of this judgement is the byte data in the data 
field except for the end part of the data field which is 
smaller than an encryption processing unit, the end part 
being generated when the data field is divided into the 
encryption processing units. 

[0052] The initial unit judgement unit 525 notifies the 
encryption calculation unit 54 that the first encryption 
processing unit of the frame is currently processed when 
the value held by the frame length extraction unit 522 is 



15 or higher and the numeral held by the frame length 
counter 523 is in the range 8 to 15. 

Separation Unit 53 

5 

[0053] The separation unit 53 includes a processing 
data buffer 531 , sequentially stores into the processing 
data buffer 531 the byte data which has been judged as 
effective by the effective range judgement unit 514 and 

10 has been judged as needed to be encrypted or decrypt- 
ed by the processing necessity judgement unit 524, and 
outputs the byte data from the processing data buffer 
531 to the encryption calculation unit 54 when eight 
pieces of byte data (i.e., 64-bit data) which constitute 

15 one encryption processing unit have been stored in the 
processing data buffer 531 . 

Encryption Calculation Unit 54 

20 [0054] The encryption calculation unit 54 includes a 
function calculation unit 541 and a key generation unit 
542, encrypts or decrypts, using the chain key method 
having been described earlier, each one encryption 
processing unit of contents data supplied from the sep- 

25 aration unit 53, and outputs the result to the combination 
unit 55. 

[0055] The function calculation unit 541 performs an 
encryption or decryption calculation on each one en- 
cryption processing unit of contents data supplied from 

30 the separation unit 53 using the key supplied from the 
key generation unit 542, outputs the calculation result 
to the combination unit 55, and at the same time, outputs 
an intermediate result of the calculation to the key gen- 
eration unit 542. 

35 [0056] The key generation unit 542 calculates the 
chain key to be used for the next one encryption 
processing unit of contents data, based on the interme- 
diate result, and supplies the function calculation unit 
541 with the chain key. Note that the key generation unit 

40 542 supplies the function calculation unit 541 with the 
initial key it stores beforehand when the initial unit judge- 
ment unit 525 notifies that the first encryption processing 
unit of the frame is currently processed. 
[0057] The encryption calculation unit 54 performs the 

45 encryption and decryption, for example, using a function 
defined in DES (Data Encryption Standard). According 
to DES. the encryption function is the same as the de- 
cryption function except for the value used as the key. 
The encryption calculation unit 54 is achieved by one 

50 circuit which can execute both the encryption and de- 
cryption. 

Combination Unit 55 

55 [0058] The combination unit 55 includes a selector 
551 and an output data buff er 552, and generates output 
data by combining both parts of the contents data, 
namely the part having been encrypted or decrypted 
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and the rest of the contents data. 
[0059] The selector 551 selects byte data which has 
been judged as effective by the effective range judge- 
ment unit 514, has been judged as needed to be en- 
crypted or decrypted by the processing necessity judge- 
ment unit 524, and has been encrypted or decrypted by 
the encryption calculation unit 54, and selects the byte 
data supplied from the input data buffer 511 which con- 
stitutes the rest of the contents data. 
[0060] The output data buffer 552 stores the byte data 
selected by the selector 551 , and outputs the byte data 
when it has stored 512 pieces of byte data constituting 
one data management block. 
[0061] The combination unit 55 stores, for example, 
null data so that the selector 551 can select the null data 
instead of the data judged as not effective by the effec- 
tive range judgement unit 514. 

Detailed Operation of Encryption Control Unit 50 

[0062] The operation of the encryption control unit 50 
will be described in detail with reference to an example 
shown in FIG. 5. In FIG. 5, "21 0" represent the encrypted 
contents data which includes four frames. The header 
field of each frame includes a synchronization code and 
a numeral indicating the frame length ("375", "281", 
"191", and "314"). This example shows that the second 
and third frames among the four frames are decrypted. 
The "effective range specification data" 220 indicates an 
effective range as from the start of the second frame to 
the end of the third frame. More specifically, the "effec- 
tive range specification data" 220 specifies "376" and 
"512" for the data management block 201, and "1" and 
"335" for the data management block 202. These spec- 
ifications show that the 376*^ byte to the 51 2 byte in the 
data management block 201 and the 1 ^ byte to the 335*^ 
byte in the data management block 202 are effective 
ranges of the second and third frames. 
[0063] FIG. 5 shows how signals 230 to 250 and the 
decrypted contents data 260 are output when the en- 
crypted contents data 21 0 and the effective range spec- 
ification data 220 are supplied. The effective signal 230 
is output from the effective range judgement unit 514 
and indicates that the byte data in the range indicated 
by the effective range specification data 220 is effective. 
The processing necessary signal 240 is output from the 
processing necessity judgement unit 524, and indicates 
the byte data that should be encrypted or decrypted. The 
initial unit signal 250 is output from the initial unit judge- 
ment unit 525, and indicates the byte data constituting 
the first encryption processing unit of a frame. 
[0064] The areas with slanted lines in the encrypted 
contents data 210 indicate encrypted parts. The second 
and third frames, the target of decryption, range from 
the 376*^ byte of the data management block 201 to the 
1 44*^ byte of the data management block 202 and from 
the 1 45^ byte to the 335*^ byte of the data management 
block 202, respectively. 



[0065] The effective range specification data 220 is 
generated to specify the above two frames as the effec- 
tive range. As a result, the effective range specification 
data 220 is made to include numerals that specify the 

5 376*^ byte to the last (512*^) byte in the data manage- 
ment block 201 and the 1®* byte to the 335**^ byte in the 
data management block 202. Now, the operation will be 
described for each data management block in order 
(1 ) The acquisition unit 51 acquires the first data man- 

^0 agement block of the contents data, namely data man- 
agement block 201, also acquires "376" and "512" as 
the numerals indicating the start and end bytes of a 
range of the effective byte data in the data management 
block 201 , and stores the data management block 201 

^5 and the numerals into the input data buffer 511 and the 
effective range register 515, respectively. 
[0066] The block-length counter 51 3 shows the bytes 
#1 to #51 2 in order for the data management block 201 . 
The input data buffer 511 sequentially outputs byte data 

20 corresponding to the byte serial numbers shown by the 
block-length counter 513. 

[0067] The effective range judgement unit 514 out- 
puts an effective signal specifying the byte data ranging 
from "376" to "512" shown by the block-length counter 
25 513. 

[0068] The selector 551 selects null values for the first 
to 375^ byte data of the data management block 201 
which are excluded from the processing target specified 
by the effective signal output from the effective range 
30 judgement unit 51 4. 

[0069] The output data buffer 552 stores the selected 
null values at the positions corresponding to the first to 
375*^ byte data. 

[0070] The synchronization signal detection unit 521 

35 detects the synchronization code at the start of the sec- 
ond frame, namely from the 376*^ byte to the 377^ byte 
by monitoring the byte data specified as the processing 
target by the effective signal 230 when the frame length 
counter 523 has value 0. The frame length counter 523 

40 starts counting by holding value "1" in con-espondence 
to the 376*^ byte data. The frame length extraction unit 
522 extracts a numeral "281" indicating the frame 
length, while the frame length counter 523 holds values 
"4" to "6" in order, and stores the extracted numeral. 

45 [0071] The processing necessity judgement unit 524, 
based on the condition described earlier, outputs the 
processing necessary signal 240 while the frame length 
counter 523 holds values "8" to "279" in order. The 8*^^ 
to 279^ byte data shown by the frame length counter 

50 523 correspond to' the 383"* to 512^ byte data of the 
data management block 201 and the 1®* to 142"*^ byte 
data of the data management block 202 shown by the 
block-length counter 51 3. 

[0072] The selector 551 selects the byte data supplied 
55 from the input data buffer 51 1 for the 1 ^ to 7**^ byte data 
shown by the frame length counter 523 which are spec- 
ified as the processing target by the effective signal 230, 
but not by the processing necessary signal 240. The out- 



3/1/2005. EAST 



Version: 2.0.1.-4 



17 



EP1 096 714 A2 



18 



put data buffer 552 stores the seven bytes selected by 
the selector 551 into the 376^-byte to 382"<*-byte stor- 
age areas in itself. 

[0073] The processing data buffer 531 forms the first 
encryption processing unit of the second frame by stor- 
ing the 8*^ to 15^ byte data shown by the frame length 
counter 523, and supplies the encryption calculation unit 
54 with the formed encryption processing unit. The initial 
unit judgement unit 525 outputs the initial unit signal 250 
for the 8^^ to 1 5*^ byte data in accordance with the con- 
dition described earlier. 

[0074] The key generation unit 542, after receiving the 
initial unit signal 250 from the initial unit judgement unit 
525, generates the initial key for the first encryption 
processing unit, and supplies the function calculation 
unit 541 with the initial key. 

[0075] The function calculation unit 541 decrypts the 
first encryption processing unit using the initial key, out- 
puts the decryption result to the combination unit 55, and 
outputs the intermediate result of this decryption to the 
key generation unit 542. 

[0076] The processing data buffer 531 then forms the 
second encryption processing unit of the second frame 
by storing the 1 6*^ to 23"^ byte data shown by the frame 
length counter 523, and supplies the encryption calcu- 
lation unit 54 with the formed second encryption 
processing unit. The initial unit judgement unit 525 does 
not output the initial unit signal 250 for the byte data in 
accordance with the condition described earlier. 
[0077] Since the initial unit judgement unit 525 does 
not output the initial unit signal 250, the key generation 
unit 542 generates the chain key for the second encryp- 
tion processing unit based on the intermediate result for 
the first encryption processing unit, and supplies the 
function calculation unit 541 with the chain key. 
[0078] The function calculation unit 541 decrypts the- 
second encryption processing unit using the chain key, 
outputs the decryption result to the combination unit 55, 
and outputs the intermediate result of this decryption to 
the key generation unit 542. 

[0079] The processing data buffer 531 then sequen- 
tially forms each 8-byte encryption processing unit from 
the 24^ to 279*^ byte data of the second frame which 
are specified as the processing target by both the effec- 
tive signal 230 and processing necessary signal 240, 
and supplies the encryption calculation unit 54 with each 
of the formed encryption processing units. The encryp- 
tion calculation unit 54 decrypts each of the encryption 
processing, units using the chain key, and outputs each 
decryption result to the combination unit 55. 
(2) After outputting the last byte data of the data man- 
agement block 201 , the acquisition unit 51 acquires the 
following data management block 202, and stores it in 
the input data buffer 511. The acquisition unit 51 also 
acquires "1" and "335" as the numerals indicating the 
start and end bytes of a range of the effective byte data 
in the data management block 202. The acquisition unit 
51 also acquires a flag indicating that the data manage- 



ment block 202 is the last data management block that 
includes the last portion of the data to be encrypted or 
decrypted. The acquisition unit 51 stores the numerals 
and flag into the effective range register 515. 
5 [0080] The block-length counter 513 shows the bytes 
#1 to #512 in order for the data management block 202. 
The input data buffer 51 1 sequentially outputs byte data 
conresponding to the byte serial numbers shown by the 
block-length counter 51 3. 

[0081] The effective range judgement unit 514 out- 
puts the effective signal 230 specifying the byte data 
ranging from "1" to "335" shown by the block-length 
counter 513. The effective range judgement unit 514 
does not output the effective signal 230 for the 336^*^ 
byte and onwards since they are out of effective range. 
[0082] The frame length counter 523 has "137" in cor- 
respondence to the 512^ byte of the data management 
block 201 , has "1 38" in correspondence to the first byte 
of the data management block 202, and carries on 
counting. 

[0083] The processing necessity judgement unit 524 
outputs the processing necessary signal 240 while the 
frame length counter 523 holds values "138" to "279" in 
order. 

[0084] The processing data buffer 531 stores the first 
byte of the data management block 202 after the 51 2**^ 
byte of the data management block 201 . 
[0085] The selector 551 selects eight bytes of the de- 
cryption results supplied from the encryption calculation 
unit 54 at a time for the byte data specified as the 
processing target by both the effective signal 230 and 
processing necessary signal 240, and outputs the de- 
cryption results to the output data buffer 552 on a byte- 
by-byte basis. 

[0086] The output data buffer 552 completes the first 
decrypted data management block by storing the 383"^ 
byte to the 51 2* byte of the data management block 201 
at the corresponding position, and outputs the complet- 
ed data management block. The output data buffer 552 
then stores the decryption results of the first byte to the 
142nd byte Of the data management block 202 at the 
conresponding position. 

[0087] It should be noted here that the processing 
necessary signal 240 is not output for the 1 43"* and 
144th bytes of the data management block 202 though 
these bytes belong to the data field of the second frame. 
This is because these bytes are odd pieces of data that 
cannot form one encryption processing unit. Such bytes 
are not encrypted, hence there is no need for decrypting 
the bytes. The selector 551 selects the byte data sup- 
plied from the input data buffer 51 1 in con-espondence 
to the 143"^ and 144**^ bytes. 
[0088] The synchronization signal detection unit 521 
monitors the 145**^ byte and onwards of the data man- 
agement block 202 which are specified as the process- 
ing target by the effective signal 230 when the frame 
length counter 23 has value 0, and detects that the 1 45^^ 
and 1 46**i bytes are the synchronization code at the start 



15 



20 



25 



30 



35 



40 



45 



50 



3/1/2005, EAST Version: 2.0.1.4 



19 



EP1 096 714 A2 



20 



of the third frame. 

[0089] The encryption control unit 50 processes the 
third frame in the same way as the second frame. 
[0090] The selector 551 selects null values for the 
336^^ byte to the 512^^^ byte of the data management 
block 202 which are excluded from the processing target 
specified by the effective signal 230. The output data 
buffer 552 completes the second decrypted data man- 
agement block by storing the selected null values at the 
positions con-esponding to the 336*^^ byte to the 512^ 
byte, and outputs the completed data management 
block. 

[0091] Up to this point, the decryption process per- 
formed by the encryption control unit 50 in Embodiment 
1 has been described in detail. 

Brief Account of Embodiment 1 

[0092] With the construction described above, the 
processing necessity judgement unit 524 outputs the 
processing necessary signal indicating the encrypted 
portions of the encrypted contents data. The synchroni- 
zation signal detection unit 521 detects the synchroni- 
zation code located at the start -of each frame. The initial 
unit judgement unit 525 outputs the initial unit signal in- 
dicating the first encryption processing unit of each 
frame, with reference to the position where the detected 
synchronization code is located. The encryption calcu- 
lation unit 54 decrypts the first encryption processing 
unit Indicated by the initial unit signal using the initial 
key, and the other encryption processing units using the 
chain key 

[0093] With the above construction, the encryption 
control unit 50 can properly judge which of the initial key 
and the chain key should be used for each encryption 
processing unit, without decrypting all portions of the en- 
crypted contents data. This achieves a high-speed de- 
cryption process. 

[0094] The encryption process for encrypting the con- 
tents data to conform to the above decryption process 
can be achieved by the major components including the 
encryption control unit 50 with the same construction 
and operation as above. This is because, as described 
earlier, the encryption function used in the encryption is 
the same as the decryption function used in the decryp- 
tion except for the key value, and that the construction 
and operation for decrypting certain portions of the con- 
tents data are the same as those for encrypting the cer- 
tain portions in terms of the major components. 
[0095] With the above construction, the encryption 
control unit 50 generates the encrypted contents data 
which has the same security as before since it encrypts 
the data field, and is decrypted at high speed since it 
does not encrypt the header field. 

<Embodiment 2> 

[0096] The following is a description of the encryption 



control apparatus In Embodiment 2 explained with ref- 
erence to the drawings. 

Contents Data Reception/Reproduction Apparatus 100 

5 

[0097] FIG. 6 shows the construction of the contents 
data reception/reproduction apparatus 100. The con- 
tents data reception/reproduction apparatus 1 00 of Em- 
bodiment 2 has the same construction as Embodiment 

10 1 , but differs from it in that the encryption control unit 50 
encrypts or decrypts a plurality of streams of contents 
data simultaneously with time sharing. 
[0098] For example, the encryption control apparatus 
50 with time sharing acquires received contents data 

15 301 from the communication interface unit 10 one data 
management block at a time, acquires reproduction 
contents data 302 from the memory interface unit 60 one 
data management block at a time, and encrypts and de- 
crypts both streams of contents data simultaneously 

20 with time sharing. With such an operation, the contents 
data reception/reproduction apparatus 100 performs 
two operations simultaneously: the operation of encrypt- 
ing and storing the contents data received via the net- 
work into the memory card; and the operation of decrypt- 

25 ing encrypted contents data having already been stored 
in the memory card. 

[0099] Now, only differences from Embodiment 1 will 
be described in detail. 

30 Contents Data 300 

[0100] The encryption control unit 50 acquires con- 
tents data which has been made from two streams of 
contents data by an^anging every certain numberof data 
35 management blocks from each stream alternately in 
line. The construction of the two streams of contents da- 
ta is the same as the contents data 110 in Embodiment 
1. 

[0101] FIG. Zshowsaconstructionofthecontentsda- 
^o ta 300, As shown in the drawing, the contents data 300 
is formed by arranging the data management blocks 
31 1 , 31 2 of the first contents data 310 and the data man- 
agement blocks 321 , 322 of the second contents data 
320, alternately one by one. The two streams of con- 
45 tents data may not necessarily be an-anged alternately 
so that the stream changes every data management 
block, but the number of data management blocks per 
portion for each stream may be proportionate to the data 
rate of the stream, for example. 
50 [0102] In FIG. 7, different patterns are applied to the 
data management blocks of the two streams, respec- 
tively, for the sake of convenience. 

Encryption Control Unit 50 

55 

[01 03] FIG. 8 shows the constmction of the encryption 
control unit 50 in Embodiment 2. The encryption control 
unit 50 is composed of: the acquisition unit 51 , encryp- 
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tion calculation unit 54, a first contents processing unit 
57 including the judgement unit 52, separation unit 53, 
and combination unit 55; and a second contents 
processing unit 58. The encryption control unit 50 en- 
crypts or decrypts two streams of contents data ac- 
quired with time sharing , and outputs each stream of en- 
crypted or decrypted contents data. 

Acquisition Unit 51 

[0104] The acquisition unit 51 additionally includes a 
selection signal decoder 51 2, as well as the components 
shown in Embodiment 1 . 

[0105] The acquisition unit 51 acquires with time shar- 
ing contents data from the communication interface unit 
1 0 one data management block at a time, acquires con- 
tents data from the memory interface unit 60 one data 
management block at a time, and stores the acquired 
data into the input data buffer 511 . 
[0106] The acquisition unit 51 , at the same time as it 
acquires a data management block, acquires from the 
control unit 90 information identifying a stream of con- 
tents data to which the data management block belongs, 
[0107] The selection signal decoder 512 outputs a 
first selection signal to the first contents processing unit 
57 and the encryption calculation unit 54 while the input 
data buffer 51 1 supplies each byte data of the data man- 
agement blocks acquired from the communication inter- 
face unit 10, and outputs a second selection signal to 
the second contents processing unit 58 and the encryp- 
tion calculation unit 54 while the input data buffer 511 
supplies each byte data of the data management blocks 
acquired from the memory interface unit 60. 

First Contents Processing Unit 57 

[0108] The first contents processing unit 57 includes 
a judgement unit 52, a separation unit 53, and a combi- 
nation unit 55. These three units in the first contents 
processing unit 57 have the same constructions and 
functions as corresponding units in Embodiment 1, but 
process only the contents data acquired from the com- 
munication interface unit 1 0 by processing the byte data 
Input with the first selection signal and not processing 
the byte data without the first selection signal. 

Second Contents Processing Unit 58 

[0109] The second contents processing unit 58 has 
the same construction as the first contents processing 
unit 57, and processes only the byte data acquired from 
the memory interface unit 60. 

Encryption Calculation Unit 54 

[0110] The encryption calculation unit 54 includes a 
function calculation unit 541 , a first key generation unit 
542, and a second key generation unit 543. 



[0111] The function calculation unit 541 performs an 
encryption calculation on each encryption processing 
unit input with the first selection signal, using a key sup- 
plied from the first key generation unit 542, performs a 

5 decryption calculation on each encryption processing 
unit Input with the second selection signal, using a key 
supplied from the second key generation unit 543. and 
outputs the encrypted or decrypted contents data to the 
combination unit 55 in the corresponding contents 

10 processing unit. 

[0112] The first key generation unit 542 is constructed 
the same as the key generation unit in Embodiment 1 , 
but generates a key used for encrypting the encryption 
processing unit given with the first selection signal. 

^5 [0113] The second key generation unit 543 is con- 
structed the same as the key generation unit in Embod- 
iment 1 , but generates a key used for decrypting the en- 
cryption processing unit given with the second selection 
signal. 

20 

Detailed Operation of Encryption Control Unit 50 

[0114] The operation of the encryption control unit 50 
will be described In detail with reference to an example 

25 shown in FIG. 9. 

[0115] FIG. 9 shows how various signals and output 
contents data are output when the encrypted contents 
data 41 0 and the effective range specification data 420 
are supplied. The first selection signal 471 and the sec- 

30 ond selection signal 472 are output from the selection 
signal decoder 512 in correspondence to each stream 
of contents data in the input contents data 410. The ef- 
fective signal 430 is output from the effective range 
judgement unit 514. The processing necessary signal 

35 441 is output from the processing necessity judgement 
unit 524 in the first contents processing unit. Also, the 
initial unit signal 451 Is output from the first contents 
processing unit. The processing necessary signal 442, 
initial unit signal 452, and output contents data 462 are 

40 output in relation to the second contents processing unit. 
[0116] In FIG. 9, the areas with slanted lines in the 
input contents data 41 0 and the output contents data 
461 indicate encrypted parts. 
[0117] In the present example, the encryption control 

45 unit 50 acquires, as input contents data 41 0, data man- 
agement blocks 401 , 402. 403, and 404 one by one al- 
ternately, the data management blocks 401 and 403 be- 
ing sent from the communication interface unit 10. and 
the data management blocks 402 and 404 from the 

50 memory Interface unit 60. The effective range specifica- 
tion data 420 specifies the effective range which In- 
cludes: the first frame sent from the communication In- 
terface unit 10; and the first and second frames sent 
from the memory interface unit 60. The operation will be 

55 described in detail for each data management block, 
(1 ) While the input data buffer 511 supplies each piece 
of byte data of the data management block 401 . the se- 
lection signal decoder 51 2 outputs the first selection sig- 
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nal 471 . The first contents processing unit 57 processes 
each piece of byte data of the data management block 
401 given with the first selection signal 471 . The second 
contents processing unit 58 does not process these 
pieces of byte data since the second selection signal 
472 is not given with the byte data. 
[0118] The encryption calculation unit 54 receives the 
first selection signal from the selection signal decoder 
512. and at the same time receives, from the separation 
unit 53, the encryption processing unit composed of the 
byte data in the data management block 401 specified 
by the processing necessary signal. The first key gen- 
eration unit 542 generates a key used for encrypting this 
encryption processing unit. The function calculation unit 
541 encrypts this encryption processing unit using this 
key, and outputs the encryption result. 
[01 1 9] The encryption result is processed by the com- 
bination unit 55 of the first contents processing unit 57. 
The second contents processing unit 58 does not proc- 
ess this encryption result. 

[0120] Note that the operation of the judgement unit 
52, separation unit 53, and combination unit 55 onto 
each piece of byte data of the data management block 
401 is not described here since it is the same as Em- 
bodiment 1. 

(2) While the input data buffer 511 supplies each piece 
of byte data of the data management block 402, the se- 
lection signal decoder 512 outputs the second selection 
signal 472. The second contents processing unit 58 
processes each piece of byte data of the data manage- 
ment block 402 given with the second selection signal 
472. 

[0121] The first contents processing unit 57 does not 
process this piece of byte data since the first selection 
signal 471 is deleted. The first contents processing unit 
57 is in a state of having processed the last piece of byte 
data of the data management block 401 until the first 
contents processing unit 57 receives the first selection 
signal 471 again. 

[0122] The encryption calculation unit 54 receives the 
second selection signal from the selection signal decod- 
er 512, and at the same time receives, from the sepa- 
ration unit 53, the encryption processing unit composed 
of the byte data in the data management block 402 spec- 
ified by the processing necessary signal. The second 
key generation unit 543 generates a key used for en- 
crypting this encryption processing unit. The function 
calculation unit 541 decrypts this encryption processing 
unit using this key, and outputs the encryption result. 
[0123] The decryption result is processed by the com- 
bination unit of the second contents processing unit 58. 
The first contents processing unit 57 does not process 
this encryption result. 

(3) While the input data buffer 511 supplies each piece 
of byte data of the data management block 403, the se- 
lection signal decoder 51 2 outputs the first selection sig- 
nal 471 again. The first contents processing unit 57, giv- 
en with the first selection signal 471 , processes each 



piece of byte data of the data management block 403 
following the last piece of byte data of the data manage- 
ment block 401 . 

[0124] The second contents processing unit 58 does 
5 not process this piece of byte data since the second se- 
lection signal 472 is deleted. The second contents 
processing unit 58 is in a state of having processed the 
last piece of byte data of the data management block 
402 until the second contents processing unit 58 re- 
ceives the second selection signal 472 again. 
(4) While the input data buffer 511 supplies each piece 
of byte data of the data management block 404, the se- 
lection signal decoder 512 outputs the second selection 
signal 472 again. The second contents processing unit 
58, given with the second selection signal 472, process- 
es each piece of byte data of the data management 
block 404 following the last piece of byte data of the data 
management block 402. 

[0125] Up to this point, the operation of the encryption 
control unit 50 for encrypting or decrypting two pieces 
of contents data simultaneously with time sharing has 
been described. 

Brief Account of Embodiment 2 

[01 26] With the above constmction, if a stream of con- 
tents data is not distributed at the real-time rate due to 
the slow communication speed in the network, users 
can receive this stream of contents data, and at the 
same time reproduce another stream of encrypted con- 
tents data having already been obtained. This improves 
the utility of the present apparatus. 

<Variations> 

[0127] 

(1) In the above Embodiments, the size of the en- 
cryption processing unit is set to 64 bits. It is need- 
less to say, however, that different sizes can be ap- 
plied to the encryption processing unit. 

(2) In the above Embodiments, the initial key is used 
for encrypting or decrypting the first encryption 
processing unit, and the chain key for the other en- 
cryption processing units of each frame. However, 
the chain key may be used for the succeeding, con- 
tinuous frames. 

(3) In the above Embodiments, the end part of each 
data field which is smaller than the encryption 
processing unit is excluded from the encryption or 
decryption target. However, the end part may be en- 
crypted or decrypted after the end part is enlarged 
to the size of the encryption processing unit by add- 
ing null data to the part. 

With this construction, the security of the en- 
crypted contents data increases since the data field 
is completely encrypted. 

(4) In the above Embodiments, each header field is 
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not encrypted or decrypted. However, when the 
header field includes management information 
such as the number times the contents data has ac- 
tually been copied, the management information 
may be encrypted or decrypted. 5 

With the above construction, unauthorized cop- 
ying of the encrypted contents data is prevented 
more reliably. 

[0128] The present invention has been fully described 
by way of examples with reference to the accompanying 
drawings, it is to be noted that various changes and 
modifications will be apparent to those skilled in the art. 
Therefore, unless such changes and modifications de- 
part from the scope of the present invention, they should 
be construed as being included therein. 

Claims 

20 

1 . A contents data conversion apparatus for either en- 
crypting or decrypting streams of contents data 
which are each divided into a plurality of frames, 
each frame including a piece of header information 
and a contents portion, the piece of header informa- 25 
tion including attribute information of the frame, all 
contents portions in each stream of contents data 
forming a content, the contents data conversion ap- 
paratus comprising: 

30 

an acquisition unit operable to acquire one or 
more streams of contents data; 
an extraction unit operable to extract frames 
one by one from the one or more streams of 
contents data; 35 
a separation unit operable to separate each of 
the extracted frames Into the piece of header 
information and the contents portion; 
a conversion unit operable to either encrypt or 
decrypt each contents portion to generate a ^0 
converted contents portion; and 
a combination unit operable to combine each 
piece of header information with each convert- 
ed contents portion, and output a result of the 
combination. 45 

2. The contents data conversion apparatus of Claim 
1, wherein 



26 

3. The contents data conversion apparatus of Claim 

2, wherein 

the piece of header information of each frame 
includes, subsequent to the synchronization 
code, frame length information indicating a 
length of the frame, and 
the extraction unit detects the frame length in- 
formation and extracts each frame by extract- 
ing the synchronization code and succeeding 
data of the length indicated by the detected 
frame length information from the one or more 
streams of contents data. 

4. The contents data conversion apparatus of Claim 

3, wherein 

the piece of header information of each frame 
is located at a start of the frame and has a fixed 
length, and 

the separation unit separates the piece of head- 
er infomnation by separating a starting portion 
having the fixed length from each separated 
frame, and separates a remaining portion of the 
frame as the contents portion. 

5. The contents data conversion apparatus of Claim 

4, wherein 

the acquisition unit acquires one or more pieces 
of range information corresponding to the one 
or more streams of contents data on a one-to- 
one basis, each piece of range information in- 
dicating a block in the one or more streams of 
contents data, and 

the extraction unit extracts each frame from 
each block by detecting the synchronization 
code included in each block Indicated by each 
piece of range information. 

6. The contents data conversion apparatus of Claim 

5, wherein 

the conversion unit divides each separated 
contents portion into processing units each having 
a predetermined length. In order from a start, either 
encrypts or decrypts each processing unit, and 
combines ail encrypted or decrypted processing 
units of each separated contents portion with an 
end part of the separated contents portion to gen- 
erate each converted contents portion, the end part 
being smaller than one processing unit. 

7. The contents data conversion apparatus of Claim 

6, wherein 

the combination unit further outputs the one 
or more streams of contents data acquired by the 
acquisition unit excluding the frames extracted by 
the extraction unit. 



the piece of header information of each frame 50 
includes, at a certain position in the piece of 
header information, a synchronization code 
that is a predetermined pattern of bits, and 
the extraction unit detects the synchronization 
code from each piece of header information 55 
and extracts each frame from the one or more 
streams of contents data based on the detected 
synchronization codes. 
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8. The contents data conversion apparatus of Claim 
6, wherein 

the combination unit further outputs null data 
as a replacement for parts of the one or more 
streams of contents data acquired by the acquisi- 
tion unit other than the frames extracted by the ex- 
traction unit. 

9. The contents data conversion apparatus of Claim 
1 , wherein 

the extraction unit includes one or more sub- 
extraction units which operate in parallel, the 
one or more sub-extraction units coaesponding 
to the one or more streams of contents data on 
a one-to-one basis, and- each sub-extraction 
unit extracting frames one by one from a corre- 
sponding stream of contents data, 
the separation unit includes one or more sub- 
separation units which correspond to the one 
or more sub-extraction units on a one-to-one 
basis and operate in parallel, each sub-sepa- 
ration unit separating each frame extracted by 
a corresponding sub-extraction unit into the 
piece of header information and the contents 
portion and storing the contents portion, 
the conversion un it converts each contents por- 
tion separated by each sub-separation unit into 
each converted contents portion, and 
the combination unit includes one or more sub- 
combination units which correspond to the one 
or more sub-separation units on a one-to-one 
basis and operate in parallel, each sub-combi- 
nation unit combining each piece of header in- 
formation separated by a corresponding sub- 
separation unit with each converted contents 
portion converted from each contents portion 
separated by the corresponding sub-separa- 
tion unit, and outputting a result of the combi- 
nation. 

10. The contents data conversion apparatus of Claim 

9, wherein 

the acquisition unit acquires.multiplexed con- 
tents data in which a plurality of streams of con- 
tents data have been multiplexed, separates 
the multiplexed contents data into the plurality 
of streams of contents data, and 
the one or more sub-extraction units con-e- 
spond to the plurality of streams of contents da- 
ta on a one-to-one basis, and each sub-extrac- 
tion unit extracts frames one by one from a cor- 
responding stream of contents data separated 
by the acquisition unit. 

11. The contents data conversion apparatus of Claim 

10, wherein 



the piece of header information of each frame 
includes, at a certain position in the piece of 
header information, a synchronization code 
that is a predetermined pattern of bits, and 

5 each sub-extraction unit detects the synchroni- 

zation code from each piece of header informa- 
tion in the corresponding stream of contents da- 
ta separated by the acquisition unit, and ex- 
tracts each frame from the corresponding 

10 stream of contents data based on the detected 

synchronization codes. 

12. The contents data conversion apparatus of Claim 

11, wherein 

75 

the piece of header information of each frame 
includes, subsequent to the synchronization 
code, frame length information indicating a 
length of the frame, and 

20 each sub-extraction unit detects the frame 

length information and extracts each frame by 
extracting the synchronization code and suc- 
ceeding data of the length indicated by the de- 
tected frame length information from the corre- 

25 spending stream of contents data. 

13. The contents data conversion apparatus of Claim 

12, wherein 

30 the piece of header information of each frame 

is located at a start of each frame and has a 
fixed length, and 

each sub-separation unit separates the piece 
of header information by separating a starting 
35 portion having the fixed length from each frame 

separated by the corresponding sub-extraction 
unit, and separates a remaining portion of the 
frame as the contents portion. 

40 14. The contents data conversion apparatus of Claim 

13, wherein 

the acquisition unit acquires one or more pieces 
of range information con'esponding to the one 
45 or more streams of contents data on a one-to- 

one basis, each piece of range information in- 
dicating a block in the one or more streams of 
contents data, and 

each sub-extraction unit extracts each frame 
50 from each block by detecting the synchroniza- 

tion code included in each block indicated by 
each piece of range information. 

15. The contents data conversion apparatus of Claim 
55 14, wherein 

the conversion unit divides each separated 
contents portion into processing units each having 
a predetermined length, in order from a start, either 
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encrypts or decrypts each processing unit, and 
combines all encrypted or decrypted processing 
units of each separated contents portion with an 
end part of the separated contents portion to gen- 
erate each converted contents portion, the end part s 
being smaller than one processing unit. 

16. The contents data conversion apparatus of Claim 
15, wherein 

each sub-combination unit further outputs the io 
corresponding stream of contents data separated 
by the acquisition unit excluding the frames extract- 
ed by the corresponding sub-extraction unit. 

17. The contents data conversion apparatus of Claim ^5 
15, wherein 

each sub-combination unit further outputs null 
data as a replacement for parts of the correspond- 
ing stream of contents data separated by the acqui- 
sition unit other than the frames extracted by the 
corresponding sub-extraction unit. 

18. A contents data conversion method for use in a con- 
tents data conversion apparatus for either encrypt- 
ing or decrypting streams of contents data, the con- 25 
tents data conversion method comprising: 

an acquisition step for acquiring one or more 
streams of contents data; 

an extraction step for extracting frames one by so 
one from the one or more streams of contents 
data; 

a separation step for separating each of the ex- 
tracted frames into the piece of header Informa- 
tion and the contents portion; 35 
a conversion step for either encrypting or de- 
crypting each contents portion to generate a 
converted contents portion; and 
a combination step for combining each piece of 
header information with each converted con- <o 
tents portion, and outputting a result of the com- 
bination. 

19. A computer-readable record medium recording a 
program for use in a contents data conversion ap- ^5 
paratus for either encrypting or decrypting streams 

of contents data, the program comprising: 

an acquisition step for acquiring one or more 
streams of contents data; so 
an extraction step for extracting frames one by 
one from the one or more streams of contents 
data; 

a separation step for separating each of the ex- 
tracted frames into the piece of header informa- 55 
tion and the contents portion; 
a conversion step for either encrypting or de- 
crypting each contents portion to generate a 



converted contents portion; and 
a combination step for combining each piece of 
header information with each converted con- 
tents portion, and outputting a result of the com- 
bination. 



3/1/2005, EAST Version: 2.0.1.4 



EP 1 096 714 A2 



FIG.l 




3/1/2005, EAST Version: 2.0.1.4 



EP1 096 714 A2 




3/1/2005. EAST Version: 2.0.1.4 



EP1 096 714 A2 



o 
o 



CO 

d 




3/1/2005, EAST Version: 2.0.1.4 



EP1 096 714 A2 





d 

PL, 



3/1/2005, EAST Version: 2. 0. 1.-4 



EP 1 096 714 A2 



in 

d 

> — i 
tin 




CJ O '— 

^ ^ 

U- < Ol- 
CU OS CO 



3/1/2005. EAST Version: 2.0.1.4 



EP1 096714 A2 



CD 
O 




3/1/2005, EAST Version: 2.0.1.4 



EP1 096714 A2 




m 



9BSSSS& 



mmm 



C/5 
H 
Z 

E-< 

_o< 

c/5 U Q 



CM S 
CO 



...I 



COS 



o 



SfiBSSSSSBSSS 



Hii 



ZZZ 



7> 



7; 



7 



TT7 



fez 

uo < 



3/1/2005. EAST Version: 2. O.I. 4 



EP1 096 714 A2 



00 

in ^ 



in 



8 



o 
o 



in 



o 

a. 

I 

o 




in 



^oj£)mHs| 



3 

H 
Z 

w 
O 
Q 



in 

CM 



H 
Z 



H 
Z 



oo 

d 




3/1/2005. EAST Version: 2. O.I. 4 



EP1 096 714A2 




3/1/2005. EAST Version: 2 



.0.1 .4 



EP1 096 714 A2 




3/1/2006, EAST Version: 2.O. 



